This repository has been archived by the owner on Mar 10, 2024. It is now read-only.
panprog - MultiAccount depositAndAllocateForAccount
function doesn't scale the allocated amount correctly, failing to allocate enough funds
#15
Labels
Has Duplicates
A valid issue with 1+ other issues describing the same vulnerability
Medium
A valid Medium severity issue
Reward
A payout will be made for this issue
Sponsor Confirmed
The sponsor acknowledged this issue is valid
Will Fix
The sponsor confirmed this issue will be fixed
panprog
high
MultiAccount
depositAndAllocateForAccount
function doesn't scale the allocated amount correctly, failing to allocate enough fundsSummary
This is an issue very similar to issue 222 from previous audit contest, but in a
MultiAccount
smart contract.MultiAccount.depositAndAllocateForAccount
uses the sameamount
value both fordepositFor
and forallocate
. However, deposit amount decimals are from the collateral token while allocate amount decimals = 18. This means that for USDC (decimals = 6),depositAndAllocateForAccount
will deposit correct amount, but allocate amount which is 1e12 times smaller (dust amount).Vulnerability Detail
Internal accounting (allocatedBalances) are tracked as fixed numbers with 18 decimals, while collateral tokens can have different amount of decimals. This is correctly accounted for in
AccountFacet.depositAndAllocate
:But it is treated incorrectly in
MultiAccount.depositAndAllocateForAccount
:This leads to incorrect allocated amounts.
Impact
Similar to 222 from previous audit contest, the user expects to have full amount deposited and allocated, but ends up with only dust amount allocated, which can lead to unexpected liquidations (for example, user is at the edge of liquidation, calls depositAndAllocate to improve account health, but is liquidated instead). For consistency reasons, since this is almost identical to 222, it should also be high.
Code Snippet
The same amount is used for
depositFor
andallocate
:https://github.com/sherlock-audit/2023-08-symmetrical/blob/main/symmio-core/contracts/multiAccount/MultiAccount.sol#L167-L173
Tool used
Manual Review
Recommendation
Scale amount correctly before allocating it:
The text was updated successfully, but these errors were encountered: